<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>Android抓包配置合集 | Forgo7ten'blog</title><meta name="keywords" content="Android逆向"><meta name="author" content="Forgo7ten"><meta name="copyright" content="Forgo7ten"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="Android抓包ALL IN ONE ¶  抓包软件配置 ¶  Charles ¶  初始配置 ¶   Charles注册码 12&gt;Name: Forgo7ten.github.io&gt;Key: 6868255341EDC5CD3D    安装证书  菜单栏Help-&gt;SSL Proxying-&gt;Install Charles Root Certificate，保存到受信任">
<meta property="og:type" content="article">
<meta property="og:title" content="Android抓包配置合集">
<meta property="og:url" content="https://forgo7ten.github.io/AndroidReverse/2021/Android_traffic_capture_configuration_collection/index.html">
<meta property="og:site_name" content="Forgo7ten&#39;blog">
<meta property="og:description" content="Android抓包ALL IN ONE ¶  抓包软件配置 ¶  Charles ¶  初始配置 ¶   Charles注册码 12&gt;Name: Forgo7ten.github.io&gt;Key: 6868255341EDC5CD3D    安装证书  菜单栏Help-&gt;SSL Proxying-&gt;Install Charles Root Certificate，保存到受信任">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://forgo7ten.gitee.io/store/imgs/1.jpg">
<meta property="article:published_time" content="2021-07-23T16:00:00.000Z">
<meta property="article:modified_time" content="2022-04-23T16:00:00.000Z">
<meta property="article:author" content="Forgo7ten">
<meta property="article:tag" content="Android逆向">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://forgo7ten.gitee.io/store/imgs/1.jpg"><link rel="shortcut icon" href="/images/favicon.jpg"><link rel="canonical" href="https://forgo7ten.github.io/AndroidReverse/2021/Android_traffic_capture_configuration_collection/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//hm.baidu.com"/><link rel="preconnect" href="//www.clarity.ms"/><link rel="preconnect" href="//fonts.googleapis.com" crossorigin=""/><link rel="preconnect" href="//busuanzi.ibruce.info"/><meta name="google-site-verification" content="8L0ZjthONyq6-m7FniRTH8A7Bh0x-KOPZbKOcNimnYA"/><meta name="baidu-site-verification" content="code-gjVsyPt7yr"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.css" media="print" onload="this.media='all'"><script>var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "https://hm.baidu.com/hm.js?b076845d73a4f28b3c7401b2a0a8a9db";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script><script>(function(c,l,a,r,i,t,y){
    c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};
    t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;
    y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);
})(window, document, "clarity", "script", "9zbibmmffi");</script><link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Titillium+Web&amp;display=swap" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: {"path":"search.xml","languages":{"hits_empty":"找不到您查询的内容：${query}"}},
  translate: {"defaultEncoding":2,"translateDelay":0,"msgToTraditionalChinese":"繁","msgToSimplifiedChinese":"簡"},
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":300},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: true,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: {"chs_to_cht":"你已切换为繁体","cht_to_chs":"你已切换为简体","day_to_night":"你已切换为深色模式","night_to_day":"你已切换为浅色模式","bgLight":"#49b1f5","bgDark":"#121212","position":"bottom-left"},
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery@2/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: true,
  isAnchor: true
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'Android抓包配置合集',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2022-04-24 00:00:00'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="Forgo7ten'blog" type="application/atom+xml">
</head><body><div id="loading-box"><div class="loading-left-bg"></div><div class="loading-right-bg"></div><div class="spinner-box"><div class="configure-border-1"><div class="configure-core"></div></div><div class="configure-border-2"><div class="configure-core"></div></div><div class="loading-word">加载中...</div></div></div><div id="web_bg"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/images/avatar.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data is-center"><div class="data-item"><a href="/archives/"><div class="headline">文章</div><div class="length-num">20</div></a></div><div class="data-item"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div><div class="data-item"><a href="/categories/"><div class="headline">分类</div><div class="length-num">6</div></a></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/1.jpg')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">Forgo7ten'blog</a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search"><i class="fas fa-search fa-fw"></i><span> 搜索</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page group" href="javascript:void(0);"><i class="fa-fw fas fa-compass"></i><span> 目录</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 归档</span></a></li><li><a class="site-page child" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></li><li><a class="site-page child" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/atom.xml"><i class="fa-fw fa fa-rss"></i><span> RSS订阅</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> 友链</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div><div class="menus_item"><a class="site-page" href="/messageboard/"><i class="fa-fw fas fa-comment-dots"></i><span> 留言板</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">Android抓包配置合集</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2021-07-23T16:00:00.000Z" title="发表于 2021-07-24 00:00:00">2021-07-24</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2022-04-23T16:00:00.000Z" title="更新于 2022-04-24 00:00:00">2022-04-24</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Android%E9%80%86%E5%90%91/">Android逆向</a><i class="fas fa-angle-right post-meta-separator"></i><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Android%E9%80%86%E5%90%91/%E8%BF%87%E7%A8%8B%E8%AE%B0%E5%BD%95%E5%A4%87%E6%9F%A5/">过程记录备查</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-wordcount"><i class="far fa-file-word fa-fw post-meta-icon"></i><span class="post-meta-label">字数总计:</span><span class="word-count">2.1k</span><span class="post-meta-separator">|</span><i class="far fa-clock fa-fw post-meta-icon"></i><span class="post-meta-label">阅读时长:</span><span>8分钟</span></span><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="Android抓包配置合集"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><h1 id="Android抓包ALL-IN-ONE">Android抓包ALL IN ONE<a class="header-anchor" href="#Android抓包ALL-IN-ONE"> ¶ </a></h1>
<h2 id="抓包软件配置">抓包软件配置<a class="header-anchor" href="#抓包软件配置"> ¶ </a></h2>
<h3 id="Charles">Charles<a class="header-anchor" href="#Charles"> ¶ </a></h3>
<h4 id="初始配置">初始配置<a class="header-anchor" href="#初始配置"> ¶ </a></h4>
<blockquote>
<p>Charles注册码</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">&gt;Name: Forgo7ten.github.io</span><br><span class="line">&gt;Key: 6868255341EDC5CD3D</span><br></pre></td></tr></table></figure>
</blockquote>
<ol>
<li>
<p>安装证书</p>
<ol>
<li>菜单栏<code>Help</code>-&gt;<code>SSL Proxying</code>-&gt;<code>Install Charles Root Certificate</code>，保存到<code>受信任的根证书颁发机构</code></li>
<li><code>Save Charles Root Certificate</code>，保存证书，配置到手机</li>
</ol>
</li>
<li>
<p>配置访问控制设置</p>
<ol>
<li>菜单栏<code>Proxy</code>-&gt;<code>Access Control settings...</code></li>
<li>【Add】 <code>0.0.0.0/0</code></li>
<li>点击【OK】</li>
</ol>
</li>
<li>
<p>配置代理服务器设置</p>
<ol>
<li>
<p>菜单栏<code>Proxy</code>-&gt;<code>proxying settings...</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/image-20220106211229311.png" alt="image-20220106211229311"></p>
</li>
</ol>
</li>
<li>
<p>配置SSL代理设置</p>
<ol>
<li>菜单栏<code>Proxy</code>-&gt;<code>SSL Proxying settings...</code></li>
<li>勾选【Enable SSL Proxying】</li>
<li>【Include】下添加<code>*:443</code>或者<code>*:*</code></li>
<li>点击【OK】</li>
</ol>
</li>
</ol>
<p><strong>手机代理设置 8889端口及SOCK5代理模式</strong></p>
<p>菜单栏<code>Proxy</code>-&gt;<code>Windows Proxy(Ctrl+shift+P)</code>：Windows抓包开关（关闭后可不抓Windows的包）</p>
<p>同时<code>Proxy</code>-&gt;<code>proxying settings...</code>-&gt;<code>Windows</code>中可取消启动时自动打开windows抓包</p>
<hr>
<p>Charles抓包外网APP：配置External Proxy Settings设置来配置代理（<strong>可将包转发到BP，形成app-&gt;Charles-&gt;BurpSuite-&gt;Server链路</strong>）</p>
<h4 id="Charles添加新证书">Charles添加新证书<a class="header-anchor" href="#Charles添加新证书"> ¶ </a></h4>
<ol>
<li>菜单栏<code>Proxy</code>→<code>SSL Proxy Settings</code>→<code>Client Certificates</code>→<code>Add</code>添加新的证书</li>
<li>输入指定的域名IP以及端口并导入p12格式或者pem格式的证书</li>
</ol>
<p>之后即可将Charles伪装成使用特定证书的客户端，最终达到正常抓包的目的</p>
<h3 id="Burpsuit">Burpsuit<a class="header-anchor" href="#Burpsuit"> ¶ </a></h3>
<h4 id="Burpsuit配置上游代理">Burpsuit配置上游代理<a class="header-anchor" href="#Burpsuit配置上游代理"> ¶ </a></h4>
<p>（访问google）</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/image-20220424103048995.png" alt="image-20220424103048995"></p>
<h4 id="Burpsuit中文乱码">Burpsuit中文乱码<a class="header-anchor" href="#Burpsuit中文乱码"> ¶ </a></h4>
<p>请求与响应报文中文乱码：字体为中文字体（如果有不带编码格式的响应需要在此修改，修改编码<code>UTF-8</code>）</p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/image-20220424095508443.png" alt="image-20220424095508443"></p>
<h4 id="Burpsuit插件">Burpsuit插件<a class="header-anchor" href="#Burpsuit插件"> ¶ </a></h4>
<p>菜单栏Extender -》 BAppStore</p>
<ul>
<li>Copy as Python-Requests  ----  一键复制成python代码</li>
<li>Non HTTP Proxy（NoPE）---- 抓取非HTTP协议的数据（有些包抓不到的时候，可以尝试，原理是用伪造的DNS服务器来抓取数据）</li>
<li>JSON Query ---- 解析json数据…</li>
</ul>
<h2 id="Android配置">Android配置<a class="header-anchor" href="#Android配置"> ¶ </a></h2>
<h3 id="配置系统证书">配置系统证书<a class="header-anchor" href="#配置系统证书"> ¶ </a></h3>
<p>Android7.0系统证书目录：<code>/system/etc/security/cacerts/</code></p>
<p>用户证书目录：<code>/data/misc/user/0/cacerts-added/</code>（可以先导入用户证书、之后移动至系统证书目录、省去重命名等步骤）</p>
<p>快捷配置证书脚本：<a target="_blank" rel="noopener" href="https://gist.githubusercontent.com/Forgo7ten/19a444b9de51d5c321426e1b38bc322f/raw/7dbcd083e8cce8efd7dc2a4027296e26c4c606ce/move_cert.sh">move_cert.sh</a></p>
<h4 id="计算证书hash值">计算证书hash值<a class="header-anchor" href="#计算证书hash值"> ¶ </a></h4>
<p>需计算相应证书的hash值</p>
<blockquote>
<p><code>openssl version</code>查看openssl版本；在1.0以上使用<code>-subject_hash_old</code>、1.0以下使用<code>-subject_hash</code></p>
</blockquote>
<p><code>.cer</code>证书</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">openssl x509 -subject_hash_old -<span class="keyword">in</span> FiddlerRoot.cer -inform der</span><br></pre></td></tr></table></figure>
<p>对于<code>.pem</code>证书</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">openssl x509 -subject_hash_old -<span class="keyword">in</span> charles-proxy-ssl-proxying-certificate.pem</span><br></pre></td></tr></table></figure>
<p>其中<code>cer</code>与<code>.pem</code>互转</p>
<blockquote>
<p>.pem证书转.cer证书</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&gt;openssl x509 -outform der -<span class="keyword">in</span> demo.pem -out demo.cer</span><br></pre></td></tr></table></figure>
<p>.cer证书转.pem证书</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&gt;openssl x509 -inform der -<span class="keyword">in</span> demo.cer -out demo.pem</span><br></pre></td></tr></table></figure>
<p>系统证书目录证书格式为<code>.pem</code></p>
</blockquote>
<h4 id="重命名证书">重命名证书<a class="header-anchor" href="#重命名证书"> ¶ </a></h4>
<p>将证书重命名为<code>[hashcode].0</code></p>
<h4 id="拷贝证书进入系统根证书目录">拷贝证书进入系统根证书目录<a class="header-anchor" href="#拷贝证书进入系统根证书目录"> ¶ </a></h4>
<p>进行证书临时拷贝</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">adb push hash.0 /sdcard/</span><br></pre></td></tr></table></figure>
<p>先将根目录重新挂载为可读可写目录</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">adb shell</span><br><span class="line">su</span><br><span class="line">mount -o rw,remount /</span><br></pre></td></tr></table></figure>
<hr>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">disable-verity</span><br><span class="line">reboot</span><br><span class="line">mount -o rw,remount /system</span><br><span class="line"></span><br><span class="line"><span class="comment"># 也可以尝试上述三个命令来挂载磁盘。</span></span><br><span class="line"><span class="comment"># 第一条命令用于关闭Android系统的校验分区</span></span><br></pre></td></tr></table></figure>
<p>将证书移动到证书目录并赋予权限、修改用户和属组</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">mv /sdcard/hash.0 /system/etc/security/cacerts/</span><br><span class="line"><span class="built_in">cd</span> /system/etc/security/cacerts/</span><br><span class="line">chmod 644 hash.0</span><br><span class="line">chown root:root hash.0</span><br></pre></td></tr></table></figure>
<p>重启</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">reboot</span><br></pre></td></tr></table></figure>
<p>其中系统凭据能找到</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">Fiddler: DO_NOT_TRUST</span><br><span class="line">Charles:XK72 Ltd</span><br></pre></td></tr></table></figure>
<blockquote>
<p>安卓8以上 修改system读写权限</p>
  <figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">adb root</span><br><span class="line">adb disable-verity</span><br><span class="line">adb reboot        // 必须重启一次，不然无法生效</span><br><span class="line"></span><br><span class="line">adb root</span><br><span class="line">adb remount</span><br></pre></td></tr></table></figure>
<p>未测试</p>
</blockquote>
<h4 id="安卓10以上，配置系统证书">安卓10以上，配置系统证书<a class="header-anchor" href="#安卓10以上，配置系统证书"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/NVISOsecurity/MagiskTrustUserCerts">https://github.com/NVISOsecurity/MagiskTrustUserCerts</a></p>
<p><a target="_blank" rel="noopener" href="https://github.com/Magisk-Modules-Repo/movecert">https://github.com/Magisk-Modules-Repo/movecert</a></p>
<h3 id="配置代理软件">配置代理软件<a class="header-anchor" href="#配置代理软件"> ¶ </a></h3>
<h4 id="adb命令代理">adb命令代理<a class="header-anchor" href="#adb命令代理"> ¶ </a></h4>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">adb shell settings put global http_proxy 127.0.0.1:8888</span><br></pre></td></tr></table></figure>
<h4 id="WiFi代理-不建议">WiFi代理(不建议)<a class="header-anchor" href="#WiFi代理-不建议"> ¶ </a></h4>
<ol>
<li>wifi修改网络</li>
<li>高级选项</li>
<li>代理：手动</li>
<li>设置主机和端口</li>
</ol>
<h4 id="Drony">Drony<a class="header-anchor" href="#Drony"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://apkpure.com/drony/org.sandroproxy.drony">Drony for Android - APK Download (apkpure.com)</a></p>
<ol>
<li>右滑到设置，点击【Networks(网络)-Wifi(无线网络)】</li>
<li>选择【当前Wifi】</li>
<li>【Proxy type(代理類型)】选择【Manual(手動)】</li>
<li>设置【Hostname(主機名)】和【Port(端口)】</li>
<li>将【Filter default value(過濾默認值)】改为【4 Direct all(引導全部)】（可改可不改）</li>
<li>进入【Rules(規則)】</li>
<li>新建规则，选择【本地代理鏈全部】，【选择相应APP】，其他不选</li>
<li>在开始页面，将【OFF】改为【ON】，开始代理</li>
</ol>
<h4 id="Postern">Postern<a class="header-anchor" href="#Postern"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://play.google.com/store/apps/details?id=com.tunnelworkshop.postern&amp;hl=zh&amp;gl=US">Postern - Google Play 上的应用</a></p>
<p>安装postern</p>
<h5 id="配置代理">配置代理<a class="header-anchor" href="#配置代理"> ¶ </a></h5>
<p>服务器名称：随意<br>
服务器地址：电脑局域网地址<br>
服务器端口：8888（与fiddler等端口一致）<br>
代理类型：HTTPS/HTTP CONNECT<br>
保存</p>
<p><strong>另为配合Charles，配置一个代理类型为<code>SOCKS5</code>，以捕获该类型的数据包</strong>，端口等要与电脑抓包软件相符</p>
<h5 id="配置规则">配置规则<a class="header-anchor" href="#配置规则"> ¶ </a></h5>
<p>匹配类型: 匹配所有地址<br>
动作: 通过代理连接<br>
代理/代理组：选择相应代理<br>
勾选开启抓包<br>
目标地址：*<br>
保存</p>
<h5 id="右侧菜单打开VPN">右侧菜单打开VPN<a class="header-anchor" href="#右侧菜单打开VPN"> ¶ </a></h5>
<p>右侧菜单打开VPN</p>
<h4 id="clash">clash<a class="header-anchor" href="#clash"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/Kr328/ClashForAndroid/releases">Releases · Kr328/ClashForAndroid (github.com)</a> cfa-2.5.11-premium-universal-release.apk</p>
<p>从文件中导入配置</p>
<p>charles.yaml</p>
<figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">mixed-port:</span> <span class="number">7890</span></span><br><span class="line"></span><br><span class="line"><span class="attr">allow-lan:</span> <span class="literal">false</span></span><br><span class="line"></span><br><span class="line"><span class="attr">mode:</span> <span class="string">global</span></span><br><span class="line"></span><br><span class="line"><span class="attr">external-controller:</span> <span class="number">127.0</span><span class="number">.0</span><span class="number">.1</span><span class="string">:9090</span></span><br><span class="line"></span><br><span class="line"><span class="attr">log-level:</span> <span class="string">info</span></span><br><span class="line"></span><br><span class="line"><span class="attr">dns:</span></span><br><span class="line">    <span class="attr">enable:</span> <span class="literal">true</span></span><br><span class="line">    <span class="attr">ipv6:</span> <span class="literal">true</span></span><br><span class="line">    <span class="attr">enhanced-mode:</span> <span class="string">redir-host</span></span><br><span class="line">    <span class="attr">nameserver:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="number">114.114</span><span class="number">.114</span><span class="number">.114</span></span><br><span class="line"></span><br><span class="line"><span class="attr">proxies:</span></span><br><span class="line"><span class="bullet">-</span> <span class="attr">name:</span> <span class="string">&quot;转发Charles&quot;</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">socks5</span></span><br><span class="line">  <span class="attr">server:</span> <span class="number">192.168</span><span class="number">.1</span><span class="number">.1</span></span><br><span class="line">  <span class="attr">port:</span> <span class="number">8889</span></span><br><span class="line">    </span><br><span class="line"><span class="attr">proxy-groups:</span></span><br><span class="line"></span><br><span class="line"><span class="attr">rules:</span></span><br></pre></td></tr></table></figure>
<p>自行修改proxies下的ip地址与端口号</p>
<h4 id="SocksDroid">SocksDroid<a class="header-anchor" href="#SocksDroid"> ¶ </a></h4>
<p><a target="_blank" rel="noopener" href="https://github.com/PeterCxy/SocksDroid">PeterCxy/SocksDroid (github.com)</a></p>
<h2 id="调试WebView">调试WebView<a class="header-anchor" href="#调试WebView"> ¶ </a></h2>
<p>使用Chrome DevTools <a target="_blank" rel="noopener" href="https://developer.chrome.com/docs/devtools/">Chrome DevTools - Chrome Developers</a></p>
<ol>
<li>
<p>电脑usb连接手机</p>
</li>
<li>
<p>Chrome访问地址<code>chrome://inspect</code></p>
<p><img src= "" data-lazy-src="/AndroidReverse/2021/Android_traffic_capture_configuration_collection/image-20220106141702599.png" alt="image-20220106141702599"></p>
</li>
</ol>
<p>该调试方法依赖于 APP自身必须调用<code>WebView.setWebContentsDebuggingEnabled(true);</code>才会允许被DevTools调试</p>
<p>可以安装Xopsed模块 <a target="_blank" rel="noopener" href="https://github.com/feix760/WebViewDebugHook">GitHub - feix760/WebViewDebugHook: Use Xposed force all webView to debug on android 4.4+</a></p>
<p>自行编写 只需要在目标APP进程中调用静态方法<code>WebView.setWebContentsDebuggingEnabled(true);</code></p>
<h2 id="HOOK抓包">HOOK抓包<a class="header-anchor" href="#HOOK抓包"> ¶ </a></h2>
<p>清空<code>~/.objection/objection.log</code>日志文件，objection载入APP</p>
<p>获取加载的所有类</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">android hooking list classes</span><br></pre></td></tr></table></figure>
<p>关闭objection，使用grep来过滤网络相关类。结果保存到一个文件</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">cat objection.log | grep -i HttpURLConnection &gt;&gt; classes.txt</span><br><span class="line">cat objection.log | grep -i okhttp &gt;&gt; classes.txt</span><br><span class="line">cat objection.log | grep -i okhttp3 &gt;&gt; classes.txt</span><br></pre></td></tr></table></figure>
<p>在该文件 每行行首添加<code>android hooking watch class</code>(多行编辑)</p>
<p>objection载入APP时，使用<code>-c</code>参数选定命令文件载入</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">objection -g com.example.app explore -c <span class="string">&quot;classes.txt&quot;</span></span><br></pre></td></tr></table></figure>
<p>可以确定APP的网络请求框架，</p>
<p>之后定位到APP自身的具体方法</p>
<ul>
<li>对混淆后的 okhttp 进行Hook：<a target="_blank" rel="noopener" href="https://github.com/siyujie/okhttpLogger-Frida">siyujie/OkHttpLogger-Frida: Frida 实现拦截okhttp的脚本 (github.com)</a></li>
<li><a target="_blank" rel="noopener" href="https://github.com/r0ysue/r0capture">r0ysue/r0capture: 安卓应用层抓包通杀脚本 (github.com)</a></li>
</ul>
<h2 id="抓包对抗">抓包对抗<a class="header-anchor" href="#抓包对抗"> ¶ </a></h2>
<ul>
<li>SSL Pinning，又称证书绑定，可以说是客户端校验服务器的进阶版：该种方式不仅校验服务器证书是否是系统中的可信凭证，在通信过程中甚至连系统内置的证书都不信任而只信任App指定的证书。一旦发现服务器证书为非指定证书即停止通信，最终导致即使将Charles证书安装到系统信任凭据中也无法生效。</li>
<li>服务器校验客户端(双向校验)：这种方式发生在HTTPS验证身份阶段，服务器在接收到客户端的公钥后，在发送session key之前先对客户端的公钥进行验证，如果不是信任的证书公钥，服务器就中止和客户端的通信。</li>
</ul>
<h3 id="SSL-Pinning-Bypass">SSL Pinning Bypass<a class="header-anchor" href="#SSL-Pinning-Bypass"> ¶ </a></h3>
<p>证书绑定校验（客户端校验证书）</p>
<p>对于Android APP来说通常有两种方式：</p>
<ul>
<li>客户端持有证书公钥hash</li>
<li>客户端持有证书文件</li>
</ul>
<p>校验分为两种方式：</p>
<ul>
<li>代码校验</li>
<li>配置校验：<code>res/xml/network_security_config.xml</code></li>
</ul>
<h4 id="判断">判断<a class="header-anchor" href="#判断"> ¶ </a></h4>
<p>抓包报错</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">Client closed the connection before a request was made. Possibly the SSL certificate was rejected.</span><br><span class="line">You may need to configure your browser or application to trust the Charles Root Certificate. See SSL Proxying in the Help menu.</span><br></pre></td></tr></table></figure>
<p>定位：objection HOOK<code>Java.io.File.\$init</code>，查看是否有参数为<code>/system/etc/security/cacerts</code></p>
<h4 id="绕过">绕过<a class="header-anchor" href="#绕过"> ¶ </a></h4>
<h5 id="Objection">Objection<a class="header-anchor" href="#Objection"> ¶ </a></h5>
<p>objection提供命令来实现SSL Pinning Bypass</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">android sslpinning <span class="built_in">disable</span></span><br></pre></td></tr></table></figure>
<h5 id="DroidSSLUnpinning">DroidSSLUnpinning<a class="header-anchor" href="#DroidSSLUnpinning"> ¶ </a></h5>
<p><a target="_blank" rel="noopener" href="https://github.com/WooyunDota/DroidSSLUnpinning">WooyunDota/DroidSSLUnpinning: Android certificate pinning disable tools (github.com)</a></p>
<h5 id="JustTrustMe">JustTrustMe<a class="header-anchor" href="#JustTrustMe"> ¶ </a></h5>
<p><a target="_blank" rel="noopener" href="https://github.com/Fuzion24/JustTrustMe">Fuzion24/JustTrustMe: An xposed module that disables SSL certificate checking for the purposes of auditing an app with c ert pinning (github.com)</a>：自行编译仓库代码获得最新APP</p>
<h5 id="JustTrustMePlush">JustTrustMePlush<a class="header-anchor" href="#JustTrustMePlush"> ¶ </a></h5>
<h5 id="HOOK抓包-2">HOOK抓包<a class="header-anchor" href="#HOOK抓包-2"> ¶ </a></h5>
<ul>
<li><a target="_blank" rel="noopener" href="https://github.com/siyujie/OkHttpLogger-Frida">siyujie/OkHttpLogger-Frida: Frida 实现拦截okhttp的脚本 (github.com)</a></li>
<li><a target="_blank" rel="noopener" href="https://github.com/BigFaceCat2017/frida_ssl_logger">BigFaceCat2017/frida_ssl_logger: ssl_logger based on frida (github.com)</a></li>
<li><a target="_blank" rel="noopener" href="https://github.com/r0ysue/r0capture">r0ysue/r0capture: 安卓应用层抓包通杀脚本 (github.com)</a></li>
</ul>
<h3 id="服务器校验客户端证书">服务器校验客户端证书<a class="header-anchor" href="#服务器校验客户端证书"> ¶ </a></h3>
<h4 id="判断-2">判断<a class="header-anchor" href="#判断-2"> ¶ </a></h4>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">400 No required SSL certificate was sent</span><br></pre></td></tr></table></figure>
<h4 id="绕过-2">绕过<a class="header-anchor" href="#绕过-2"> ¶ </a></h4>
<p>逆向分析代码 或 Frida hook获取证书密钥</p>
<p><a target="_blank" rel="noopener" href="http://keystore-explorer.org/">KeyStore Explorer (keystore-explorer.org)</a> 转换证书格式</p>
<p>将App中内置的证书导入抓包软件（charles或Burp）中，使得服务端认为自己仍旧是在与其信任的客户端进行通信，最终达到欺骗服务器的作用。</p>
<h3 id><a class="header-anchor" href="#"> ¶ </a></h3>
<h2 id="好文">好文<a class="header-anchor" href="#好文"> ¶ </a></h2>
<ul>
<li><a target="_blank" rel="noopener" href="https://ch3nye.top/Android-HTTPS%E8%AE%A4%E8%AF%81%E7%9A%84N%E7%A7%8D%E6%96%B9%E5%BC%8F%E5%92%8C%E5%AF%B9%E6%8A%97%E6%96%B9%E6%B3%95%E6%80%BB%E7%BB%93/">Android HTTPS认证的N种方式和对抗方法总结 (ch3nye.top)</a></li>
</ul>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="mailto:undefined">Forgo7ten</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://forgo7ten.github.io/AndroidReverse/2021/Android_traffic_capture_configuration_collection/">https://forgo7ten.github.io/AndroidReverse/2021/Android_traffic_capture_configuration_collection/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://Forgo7ten.github.io" target="_blank">Forgo7ten'blog</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/Android%E9%80%86%E5%90%91/">Android逆向</a></div><div class="post_share"><div class="social-share" data-image="http://forgo7ten.gitee.io/store/imgs/1.jpg" data-sites="facebook,twitter,wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/social-share.js/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/social-share.js/dist/js/social-share.min.js" defer></script></div></div><div class="post-reward"><div class="reward-button"><i class="fas fa-qrcode"></i> 打赏</div><div class="reward-main"><ul class="reward-all"><li class="reward-item"><a href="/images/wechat.png" target="_blank"><img class="post-qr-code-img" src="/images/wechat.png" alt="wechat"/></a><div class="post-qr-code-desc">wechat</div></li><li class="reward-item"><a href="/images/alipay.jpg" target="_blank"><img class="post-qr-code-img" src="/images/alipay.jpg" alt="alipay"/></a><div class="post-qr-code-desc">alipay</div></li></ul></div></div><nav class="pagination-post" id="pagination"><div class="prev-post pull-left"><a href="/AndroidReverse/2021/Initial_xposed_module_development/"><img class="prev-cover" src="http://forgo7ten.gitee.io/store/imgs/11.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of previous post"><div class="pagination-info"><div class="label">上一篇</div><div class="prev_info">Xposed 模块开发一 环境搭建</div></div></a></div><div class="next-post pull-right"><a href="/AndroidReverse/2021/Edit_the_Android_image_boot.img/"><img class="next-cover" src="http://forgo7ten.gitee.io/store/imgs/12.jpg" onerror="onerror=null;src='/img/404.jpg'" alt="cover of next post"><div class="pagination-info"><div class="label">下一篇</div><div class="next_info">编辑Android镜像boot.img修改全局可调试</div></div></a></div></nav><div class="relatedPosts"><div class="headline"><i class="fas fa-thumbs-up fa-fw"></i><span>相关推荐</span></div><div class="relatedPosts-list"><div><a href="/AndroidReverse/2021/Analysis_of_WeChat/" title="vx逆向分析随笔"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-08-14</div><div class="title">vx逆向分析随笔</div></div></a></div><div><a href="/AndroidReverse/2022/Android_dynamic_debugging_collection/" title="Android APK无源码动态调试合集"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/3.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-01-21</div><div class="title">Android APK无源码动态调试合集</div></div></a></div><div><a href="/AndroidReverse/2021/Initial_xposed_module_development/" title="Xposed 模块开发一 环境搭建"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/11.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2021-07-12</div><div class="title">Xposed 模块开发一 环境搭建</div></div></a></div><div><a href="/AndroidReverse/2022/Frida_all_in_one/" title="Frida all in one"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/14.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-04-23</div><div class="title">Frida all in one</div></div></a></div><div><a href="/AndroidReverse/2022/Learning_about_cryptographic_algorithms/" title="对加密算法的学习"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/18.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-02-07</div><div class="title">对加密算法的学习</div></div></a></div><div><a href="/AndroidReverse/2022/Android_devices_init/" title="Android刷机记录"><img class="cover" src="http://forgo7ten.gitee.io/store/imgs/13.jpg" alt="cover"><div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> 2022-05-03</div><div class="title">Android刷机记录</div></div></a></div></div></div><hr/><div id="post-comment"><div class="comment-head"><div class="comment-headline"><i class="fas fa-comments fa-fw"></i><span> 评论</span></div></div><div class="comment-wrap"><div><div id="gitalk-container"></div></div></div></div></div><div class="aside-content" id="aside-content"><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#Android%E6%8A%93%E5%8C%85ALL-IN-ONE"><span class="toc-number">1.</span> <span class="toc-text">Android抓包ALL IN ONE</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%8A%93%E5%8C%85%E8%BD%AF%E4%BB%B6%E9%85%8D%E7%BD%AE"><span class="toc-number">1.1.</span> <span class="toc-text">抓包软件配置</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#Charles"><span class="toc-number">1.1.1.</span> <span class="toc-text">Charles</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%88%9D%E5%A7%8B%E9%85%8D%E7%BD%AE"><span class="toc-number">1.1.1.1.</span> <span class="toc-text">初始配置</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Charles%E6%B7%BB%E5%8A%A0%E6%96%B0%E8%AF%81%E4%B9%A6"><span class="toc-number">1.1.1.2.</span> <span class="toc-text">Charles添加新证书</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#Burpsuit"><span class="toc-number">1.1.2.</span> <span class="toc-text">Burpsuit</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#Burpsuit%E9%85%8D%E7%BD%AE%E4%B8%8A%E6%B8%B8%E4%BB%A3%E7%90%86"><span class="toc-number">1.1.2.1.</span> <span class="toc-text">Burpsuit配置上游代理</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Burpsuit%E4%B8%AD%E6%96%87%E4%B9%B1%E7%A0%81"><span class="toc-number">1.1.2.2.</span> <span class="toc-text">Burpsuit中文乱码</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Burpsuit%E6%8F%92%E4%BB%B6"><span class="toc-number">1.1.2.3.</span> <span class="toc-text">Burpsuit插件</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Android%E9%85%8D%E7%BD%AE"><span class="toc-number">1.2.</span> <span class="toc-text">Android配置</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E9%85%8D%E7%BD%AE%E7%B3%BB%E7%BB%9F%E8%AF%81%E4%B9%A6"><span class="toc-number">1.2.1.</span> <span class="toc-text">配置系统证书</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E8%AE%A1%E7%AE%97%E8%AF%81%E4%B9%A6hash%E5%80%BC"><span class="toc-number">1.2.1.1.</span> <span class="toc-text">计算证书hash值</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E9%87%8D%E5%91%BD%E5%90%8D%E8%AF%81%E4%B9%A6"><span class="toc-number">1.2.1.2.</span> <span class="toc-text">重命名证书</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%8B%B7%E8%B4%9D%E8%AF%81%E4%B9%A6%E8%BF%9B%E5%85%A5%E7%B3%BB%E7%BB%9F%E6%A0%B9%E8%AF%81%E4%B9%A6%E7%9B%AE%E5%BD%95"><span class="toc-number">1.2.1.3.</span> <span class="toc-text">拷贝证书进入系统根证书目录</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%AE%89%E5%8D%9310%E4%BB%A5%E4%B8%8A%EF%BC%8C%E9%85%8D%E7%BD%AE%E7%B3%BB%E7%BB%9F%E8%AF%81%E4%B9%A6"><span class="toc-number">1.2.1.4.</span> <span class="toc-text">安卓10以上，配置系统证书</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E9%85%8D%E7%BD%AE%E4%BB%A3%E7%90%86%E8%BD%AF%E4%BB%B6"><span class="toc-number">1.2.2.</span> <span class="toc-text">配置代理软件</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#adb%E5%91%BD%E4%BB%A4%E4%BB%A3%E7%90%86"><span class="toc-number">1.2.2.1.</span> <span class="toc-text">adb命令代理</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#WiFi%E4%BB%A3%E7%90%86-%E4%B8%8D%E5%BB%BA%E8%AE%AE"><span class="toc-number">1.2.2.2.</span> <span class="toc-text">WiFi代理(不建议)</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Drony"><span class="toc-number">1.2.2.3.</span> <span class="toc-text">Drony</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#Postern"><span class="toc-number">1.2.2.4.</span> <span class="toc-text">Postern</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#%E9%85%8D%E7%BD%AE%E4%BB%A3%E7%90%86"><span class="toc-number">1.2.2.4.1.</span> <span class="toc-text">配置代理</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#%E9%85%8D%E7%BD%AE%E8%A7%84%E5%88%99"><span class="toc-number">1.2.2.4.2.</span> <span class="toc-text">配置规则</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#%E5%8F%B3%E4%BE%A7%E8%8F%9C%E5%8D%95%E6%89%93%E5%BC%80VPN"><span class="toc-number">1.2.2.4.3.</span> <span class="toc-text">右侧菜单打开VPN</span></a></li></ol></li><li class="toc-item toc-level-4"><a class="toc-link" href="#clash"><span class="toc-number">1.2.2.5.</span> <span class="toc-text">clash</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#SocksDroid"><span class="toc-number">1.2.2.6.</span> <span class="toc-text">SocksDroid</span></a></li></ol></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%B0%83%E8%AF%95WebView"><span class="toc-number">1.3.</span> <span class="toc-text">调试WebView</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#HOOK%E6%8A%93%E5%8C%85"><span class="toc-number">1.4.</span> <span class="toc-text">HOOK抓包</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%8A%93%E5%8C%85%E5%AF%B9%E6%8A%97"><span class="toc-number">1.5.</span> <span class="toc-text">抓包对抗</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#SSL-Pinning-Bypass"><span class="toc-number">1.5.1.</span> <span class="toc-text">SSL Pinning Bypass</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%88%A4%E6%96%AD"><span class="toc-number">1.5.1.1.</span> <span class="toc-text">判断</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E7%BB%95%E8%BF%87"><span class="toc-number">1.5.1.2.</span> <span class="toc-text">绕过</span></a><ol class="toc-child"><li class="toc-item toc-level-5"><a class="toc-link" href="#Objection"><span class="toc-number">1.5.1.2.1.</span> <span class="toc-text">Objection</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#DroidSSLUnpinning"><span class="toc-number">1.5.1.2.2.</span> <span class="toc-text">DroidSSLUnpinning</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#JustTrustMe"><span class="toc-number">1.5.1.2.3.</span> <span class="toc-text">JustTrustMe</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#JustTrustMePlush"><span class="toc-number">1.5.1.2.4.</span> <span class="toc-text">JustTrustMePlush</span></a></li><li class="toc-item toc-level-5"><a class="toc-link" href="#HOOK%E6%8A%93%E5%8C%85-2"><span class="toc-number">1.5.1.2.5.</span> <span class="toc-text">HOOK抓包</span></a></li></ol></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9C%8D%E5%8A%A1%E5%99%A8%E6%A0%A1%E9%AA%8C%E5%AE%A2%E6%88%B7%E7%AB%AF%E8%AF%81%E4%B9%A6"><span class="toc-number">1.5.2.</span> <span class="toc-text">服务器校验客户端证书</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%88%A4%E6%96%AD-2"><span class="toc-number">1.5.2.1.</span> <span class="toc-text">判断</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E7%BB%95%E8%BF%87-2"><span class="toc-number">1.5.2.2.</span> <span class="toc-text">绕过</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link"><span class="toc-number">1.5.3.</span> <span class="toc-text"> ¶ </span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%A5%BD%E6%96%87"><span class="toc-number">1.6.</span> <span class="toc-text">好文</span></a></li></ol></li></ol></div></div></div></div></main><footer id="footer" style="background-image: url('http://forgo7ten.gitee.io/store/imgs/1.jpg')"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2023 By Forgo7ten</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div><div class="footer_custom_text">Hi, welcome to my <a href="https://Forgo7ten.github.io/">blog</a>!</div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="translateLink" type="button" title="简繁转换">繁</button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><a id="to_comment" href="#post-comment" title="直达评论"><i class="fas fa-comments"></i></a><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div id="local-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">本地搜索</span><span id="loading-status"></span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="is-center" id="loading-database"><i class="fas fa-spinner fa-pulse"></i><span>  数据库加载中</span></div><div class="search-wrap"><div id="local-search-input"><div class="local-search-box"><input class="local-search-box--input" placeholder="搜索文章" type="text"/></div></div><hr/><div id="local-search-results"></div></div></div><div id="search-mask"></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="/js/tw_cn.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.js"></script><script src="https://cdn.jsdelivr.net/npm/instant.page/instantpage.min.js" type="module"></script><script src="https://cdn.jsdelivr.net/npm/vanilla-lazyload/dist/lazyload.iife.min.js"></script><script src="https://cdn.jsdelivr.net/npm/node-snackbar/dist/snackbar.min.js"></script><script src="/js/search/local-search.js"></script><script>var preloader = {
  endLoading: () => {
    document.body.style.overflow = 'auto';
    document.getElementById('loading-box').classList.add("loaded")
  },
  initLoading: () => {
    document.body.style.overflow = '';
    document.getElementById('loading-box').classList.remove("loaded")

  }
}
window.addEventListener('load',preloader.endLoading())</script><div class="js-pjax"><script>function addGitalkSource () {
  const ele = document.createElement('link')
  ele.rel = 'stylesheet'
  ele.href= 'https://cdn.jsdelivr.net/npm/gitalk/dist/gitalk.min.css'
  document.getElementsByTagName('head')[0].appendChild(ele)
}

function loadGitalk () {
  function initGitalk () {
    var gitalk = new Gitalk(Object.assign({
      clientID: '9e01c692fcf5a9e47867',
      clientSecret: '6d5297eda0643a171a9e5510f5ea1c29ad851389',
      repo: 'Forgo7ten.github.io',
      owner: 'Forgo7ten',
      admin: ['Forgo7ten'],
      id: 'd5f0b2671c434f0b66795ce3fcfa4ff8',
      updateCountCallback: commentCount
    },{"language":"en","perPage":20,"distractionFreeMode":true,"pagerDirection":"last","createIssueManually":true}))

    gitalk.render('gitalk-container')
  }

  if (typeof Gitalk === 'function') initGitalk()
  else {
    addGitalkSource()
    getScript('https://cdn.jsdelivr.net/npm/gitalk@latest/dist/gitalk.min.js').then(initGitalk)
  }
}

function commentCount(n){
  let isCommentCount = document.querySelector('#post-meta .gitalk-comment-count')
  if (isCommentCount) {
    isCommentCount.innerHTML= n
  }
}

if ('Gitalk' === 'Gitalk' || !false) {
  if (false) btf.loadComment(document.getElementById('gitalk-container'), loadGitalk)
  else loadGitalk()
} else {
  function loadOtherComment () {
    loadGitalk()
  }
}</script></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/click-show-text.min.js" data-mobile="false" data-text="ヾ(≧▽≦*)o 点个收藏叭,(*^▽^*),w(ﾟДﾟ)w,ㄟ(≧◇≦)ㄏ,(/≧▽≦)/点个关注叭,Σ(っ °Д °;)っ,(●ˇ∀ˇ●),( •̀ ω •́ )✧,(*/ω＼*),ヽ(*。&gt;Д&lt;)o゜真的不收藏一下嘛,(～o￣3￣)～,ヽ（≧□≦）ノ" data-fontsize="15px" data-random="false" async="async"></script><script src="https://cdn.jsdelivr.net/npm/pjax/pjax.min.js"></script><script>let pjaxSelectors = ["title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]

var pjax = new Pjax({
  elements: 'a:not([target="_blank"])',
  selectors: pjaxSelectors,
  cacheBust: false,
  analytics: false,
  scrollRestoration: false
})

document.addEventListener('pjax:send', function () {

  // removeEventListener scroll 
  window.tocScrollFn && window.removeEventListener('scroll', window.tocScrollFn)
  window.scrollCollect && window.removeEventListener('scroll', scrollCollect)

  typeof preloader === 'object' && preloader.initLoading()
  document.getElementById('rightside').style.cssText = "opacity: ''; transform: ''"
  
  if (window.aplayers) {
    for (let i = 0; i < window.aplayers.length; i++) {
      if (!window.aplayers[i].options.fixed) {
        window.aplayers[i].destroy()
      }
    }
  }

  typeof typed === 'object' && typed.destroy()

  //reset readmode
  const $bodyClassList = document.body.classList
  $bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')

})

document.addEventListener('pjax:complete', function () {
  window.refreshFn()

  document.querySelectorAll('script[data-pjax]').forEach(item => {
    const newScript = document.createElement('script')
    const content = item.text || item.textContent || item.innerHTML || ""
    Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
    newScript.appendChild(document.createTextNode(content))
    item.parentNode.replaceChild(newScript, item)
  })

  GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()

  typeof chatBtnFn === 'function' && chatBtnFn()
  typeof panguInit === 'function' && panguInit()

  // google analytics
  typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});

  // baidu analytics
  typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);

  typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()

  // prismjs
  typeof Prism === 'object' && Prism.highlightAll()

  typeof preloader === 'object' && preloader.endLoading()
})

document.addEventListener('pjax:error', (e) => {
  if (e.request.status === 404) {
    pjax.loadUrl('/404.html')
  }
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"scale":1,"hHeadPos":0.5,"vHeadPos":0.618,"jsonPath":"/live2dw/assets/z16.model.json"},"display":{"superSample":2,"width":200,"height":400,"position":"right","hOffset":0,"vOffset":-20},"mobile":{"show":true,"scale":0.5},"react":{"opacityDefault":0.7,"opacityOnHover":0.2},"log":false});</script></body></html>